From: vinod kumar (vinodkumarmp@yahoo.com)
Date: Tue Feb 11 2003 - 19:21:17 EST
Hi ,
Is there any way to figure out where or who is trying
to open FTP session from same box .
Few days back I noticed there is a ftp session alive
always . ps -ef|grep ftp shows
ps -ef|grep ftp
root 6946 773 0 16:14:18 ? 0:00 ftpd:
<LOCAL-HOST>: connected: IDLE
It shows a connection from same host but is idle .
syslog shows every 15 mts killing this idle ftp
session ( which is normal)
This was started after we installed a new application
s/w in this box .
I tried blocking ftp access from same box through
inetd.sec . after this I don't see this idle ftp
process.
But when I looked at netstat I still see somebody is
still trying to access ftp but unable to connect .
# netstat -a |grep ftp
tcp 0 0 *.ftp *.*
LISTEN
tcp 0 0 <HOST>.ftp <HOST>.62303
TIME_WAIT
tcp 0 0 <HOST>.ftp <HOST>.62304
TIME_WAIT
#
In the netstat o/p there is a ftp listner and 2 ftp
sessions which is Waiting .
Any idea how to find out which process is trying to do
this ftp ?
Thanks
Vinod
__________________________________________________
Do you Yahoo!?
Yahoo! Shopping - Send Flowers for Valentine's Day
http://shopping.yahoo.com
--
---> Please post QUESTIONS and SUMMARIES only!! <---
To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
Name: hpux-admin@dutchworks.nl Owner: owner-hpux-admin@dutchworks.nl
Archives: ftp.dutchworks.nl:/pub/digests/hpux-admin (FTP, browse only)
http://www.dutchworks.nl/htbin/hpsysadmin (Web, browse & search)
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 11:02:26 EDT